apache / apache/cordova-plugin-inappbrowser

Throws error if embedded in iframe with different origin

Open
#541 1 comment 3 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
1.1k
Forks
2.2k
PR merge metrics
No merged PRs in 30d

Description

# Bug Report

## Problem

### What is expected to happen?
Embedded app in Iframe should load without errors

### What does actually happen?
https://github.com/apache/cordova-plugin-inappbrowser/blob/c54d10052a42d5e68c76b53991c287a19cdce12c/www/inappbrowser.js#L24-L27
this line throws the error
```bash
polyfills.5574a41….js:1 Uncaught DOMException: Blocked a frame with origin "https://websiteB" from accessing a cross-origin frame.
at https://websiteB/plugins/cordova-plugin-inappbrowser/www/inappbrowser.js:24:42
at https://websiteB/plugins/cordova-plugin-inappbrowser/www/inappbrowser.js:125:3
at e (https://websiteB/cordova.29dc09fa9fc3a7aeb58c.js:1:277)
at https://websiteB/cordova.29dc09fa9fc3a7aeb58c.js:1:379
at Object.t.mapModules (https://websiteB/cordova.29dc09fa9fc3a7aeb58c.js:1:12468)
at https://websiteB/cordova.29dc09fa9fc3a7aeb58c.js:1:11719
at a.r (https://websiteB/cordova.29dc09fa9fc3a7aeb58c.js:1:6215)
at a.fire (https://websiteB/cordova.29dc09fa9fc3a7aeb58c.js:1:7764)
at https://websiteB/cordova.29dc09fa9fc3a7aeb58c.js:1:11686
at https://websiteB/cordova.29dc09fa9fc3a7aeb58c.js:1:14390
```

As iframes are not allowed to access parent frames:
https://developer.mozilla.org/en/docs/Web/HTML/Element/iframe#Scripting

## Information
This does occur if websiteA embeds websiteB and they do not share the same origin.

### Environment, Platform, Device
Since: https://github.com/apache/cordova-plugin-inappbrowser/pull/118

## Checklist

- [x] I searched for existing GitHub issues
- [x] I updated all Cordova tooling to most recent version
- [x] I included all the necessary information above

@paule96 @danielhabenicht

Contributor guide

Open the contributing guide

Research direction

Start at www/inappbrowser.js lines 24-27 and reproduce the plugin inside an iframe where websiteA and websiteB have different origins. Investigate the cross-origin frame access reported there; done means the embedded app loads without the Uncaught DOMException in that setup.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
mobile-dev
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.